Grav Form Plugin: reCAPTCHA v3 Score Threshold Bypass via v2 Payload Key (CWE-807)

Vulnerability Key Information Summary Vulnerability Overview Title: reCAPTCHA v3 score threshold check is skipped when a v2 response field is specified in the submitted payload. Severity: Moderate CVE ID: None (No known CVE) Weakness: CWE-807 Reporter: aripalau099 Core Issue: The CAPTCHA provider decides which reCAPTCHA version to verify by examining the keys the submitter places in the payload. An unauthenticated attacker can move the token to the v2 key (even when the site is configured for v3), thereby bypassing the v3 score threshold check and achieving a complete bypass. Scope of Impact Affected Package: (Composer) Affected Versions: Fixed Version: Affected Version Details: has been affected since 8.0.6 up to and including 9.1.19 (the latest version). This was verified on the plugin HEAD in the Grav 2.0.17 tree. Unaffected: Commits in 8.0.0 and 8.0.5, titled "recaptcha v2 fixes #6127", therefore versions 8.0.0 through 8.0.5 are unaffected. Key Code Locations File Location: > This override is unconditional; therefore, the submitted payload overrides the page form parameters and the site configuration. on line 169 determines the version solely based on which array key is present: implies v3, while implies v2 checkbox. Skipped Guard Branch (v2 branch, lines 64-72): > The v2 branch ends at line 104, containing only . The two discarded checks ( and ) are read in the vendor library via , meaning the threshold is never evaluated. Attacker Profile and Gains An attacker POSTs a form with a valid , placing the token under the key, echoing , and echoing . With the site configured with , the attacker POSTs the form, using a valid , placing the token under the key, echoing , and echoing . An anonymous, unauthenticated attacker with zero Grav permissions can completely bypass reCAPTCHA v3: tokens with a score of 0.1, or tokens configured for a different action, are still accepted. Operators believe bot protection is enabled, but it is effectively disabled. POC (Executed) Using the actual , from the 2.0.17 tree: Remediation Treat the configured version as the authoritative source, using the payload only to locate the token, rather than to select the verification branch. If payload-driven fallback support is desired for mixed deployments, allow fallback only to the stricter branch, and never to the more permissive branch.

Goal Reached Thanks to every supporter — we hit 100%!

Grav Form Plugin: reCAPTCHA v3 Score Threshold Bypass via v2 Payload Key (CWE-807)

More from this source